Several beliefs about security metrics are widespread and wrong enough to cause bad decisions. This post tests six of them: that fewer findings always means better security, that one number can summarise risk, that MTTR is a standard, that targets improve behaviour on their own, that dashboards equal visibility, and that benchmarks transfer.
Myth 1: Fewer findings means better security
Fact: The count depends on how much you scan and how good the scanner is. A team that adds coverage will see findings rise. Read counts next to coverage and exploit evidence. See the vanity metrics checklist.
Myth 2: One score can summarise risk
Fact: Composite scores hide trade offs and invite arguments about weights. DORA's guidance warns against relying on a single metric, since it oversimplifies complex systems. A small set of metrics that create tension works better.
Myth 3: MTTR is one standard measure
Fact: The acronym is used for recover, repair, respond and remediate. Even within vulnerability work, the clock start varies. Define it. See three things called MTTR.
Myth 4: Setting a target fixes the problem
Fact: Targets drive action but also gaming. Goodhart's law, in its common form, says a measure that becomes a target ceases to be a good measure. Pair each target with a counter metric and spot check the data.
Myth 5: A dashboard gives you visibility
Fact: A dashboard shows what its data sources feed it. Assets missing from inventory are invisible. Start with coverage against an independent inventory. See how to define scan coverage.
Myth 6: Industry benchmarks tell you where you stand
Fact: Benchmarks depend on the population, the definitions and whether open items are counted. DORA also cautions against comparing unlike applications. Use outside numbers for rough context and your own history for decisions.
What to do instead
- Show trends with annotations for scope changes.
- Report medians and tails, not just averages.
- Keep a short list of metrics with named owners.
- Spot check closed items and suppressions every month.
- Review the metric set quarterly, and drop any that triggered no action.
A note on the data behind the claims here
The claims about Goodhart's law and DORA come from the sources below. The rest is practitioner guidance rather than research, so adapt it to your own context and test it.
How to use this list
Pick the myth your organisation believes most strongly and test it against your own data this month. For example, if leadership believes fewer findings means better security, show the coverage change alongside the count for the last four quarters. Seeing the two together usually settles the argument faster than a debate does.
If you find a myth that is true in your context, keep it, but write down why. A belief with a stated reason can be revisited. One without a reason hardens into dogma.
Quick check
Is there a single best security metric?
No. The most useful single view is usually exploited vulnerabilities open on exposed assets, but it should sit beside coverage and age.
Should we ignore industry benchmarks?
Use them lightly, and only after checking definitions and population.
Sources
Last reviewed: 19 October 2026.
